Last updated: 01.02.2026.
About This Notice
This Privacy Notice explains how Iute Affinity OÜ ("Iute Affinity", "we", "us") collects and processes personal data when individuals use our website and when we support insurance-related services provided by our partners.
Iute Affinity primarily acts as a data processor, meaning that in many cases we process personal data on behalf of and under the instructions of other companies who act as data controllers. This Privacy Notice describes Iute Affinity's role and processing activities only.
Where another company determines the purposes and means of processing, that company's privacy notice applies in parallel and provides additional information about how your personal data is used.
Who We Are
Iute Affinity is established in Estonia, registered under 17382610, address Maakri 19/1, Tallinn, 10145 Estonia.
Depending on the specific processing activity and product, Iute Affinity acts either as a data processor or, in limited cases, as an independent data controller. If you have comments or questions about this Privacy Notice, contact us at dpo@iute.com.
Personal Data We May Process
- Website and portal operation data, such as IP address, device information, browser type, session identifiers, and log files.
- Email verification and data accuracy data, including email address, verification code, and technical confirmation logs.
- Cookie identifiers, session IDs, usage preferences, and tracking pixels.
- Insurance-service data processed on behalf of partners, such as identification, contact, financial, employment, health, medical, claims, uploaded document, correspondence, payment, and reference data, depending on the product.
Purposes And Legal Bases
| Purpose | Legal basis |
|---|---|
| Website and portal operation | Article 6(1)(f) GDPR - legitimate interest in ensuring security and functionality |
| Email verification and data accuracy | Article 6(1)(f) GDPR - legitimate interest in ensuring data accuracy and preventing misuse |
| Cookies and tracking | Consent for non-essential cookies; Article 6(1)(f) GDPR for strictly necessary cookies |
| Payment Protection Insurance, Second Medical Opinion services, claims support, accounting, and reconciliation | Lawful basis determined by the relevant data controller, including contract, consent, health-related legal bases, or legal obligation where applicable |
Recipients
Where Iute Affinity acts as a processor, personal data is transmitted solely on documented instructions of the relevant data controller and only to recipients determined by that controller. Where Iute Affinity acts as a controller, we may share personal data with trusted processors such as IT, hosting, infrastructure, analytics, and communication service providers, and with competent authorities where required by law.
International Transfers
Where personal data is transferred outside the European Economic Area, we use appropriate safeguards required by applicable data protection law, such as standard contractual clauses or other approved mechanisms.
Retention
We keep personal data only for as long as necessary for the purposes for which it was collected, including to meet legal, accounting, reporting, contractual, or security requirements.
Your Rights
To the extent required by applicable data protection regulations, you have rights including access, rectification, erasure, restriction, data portability, objection, withdrawal of consent, and the right to lodge a complaint. To exercise your rights, contact us at dpo@iute.com.
Lodging A Complaint
If you believe your rights have been violated, you can contact us at dpo@iute.com or lodge a complaint with a supervisory authority, including the Estonian Data Protection Inspectorate.
Changes To This Notice
We reserve the right to update this Privacy Notice. All changes will be posted on this page, and significant changes will be communicated via our website.
Contact
For privacy-related questions, contact Iute Affinity OÜ, Maakri tn 19/1, 10145 Tallinn, Estonia.